The Bank of Canada has issued a reminder to all payment service providers (PSPs) registered under the Retail Payment Activities Act (RPAA) of their ongoing reporting obligations.

The Bank states that these requirements are critical to its supervision of PSPs under the RPAA and support the safety, soundness, and integrity of Canada’s retail payments ecosystem.

It also notes that PSPs that do not meet their reporting requirements are in violation of the RPAA and may be subject to enforcement action.

Key reporting requirements

The Bank’s reminder covers several reporting obligations that PSPs must meet, where applicable.

Incident reporting

PSPs must report any incident they become aware of that has a material impact on an end user, another PSP, or a clearing house of a clearing and settlement system.

The initial notice must be made without delay and no later than 48 hours after the PSP determines the incident is material. PSPs should also submit a final notice once the incident’s root cause and impact are known. Interim reports may also be submitted.

PSPs must also report incidents with a material impact to the affected end user, PSP, or clearing house, as well as to the Bank.

Significant changes or new activities

PSPs must notify the Bank of any significant change to their operations if the change could reasonably be expected to have a material impact on operational risks or the way end-user funds are safeguarded.

PSPs must also notify the Bank before performing a new retail payment activity. Notification is required at least five business days before the change is made.

Changes to registration information

PSPs must inform the Bank whenever there is a change, or anticipated change, to certain information provided during registration.

This includes information such as the PSP’s physical address or website address, third-party relationships, directors and major shareholders, and information about the personal or financial data collected by the PSP.

These reports must be made within specific timelines and, in many cases, must be provided 30 to 60 days before the change occurs.

Acquisitions of control and prescribed changes

PSPs are required to submit a new application for registration, and become re-registered under that new application, before making certain changes to their organizational structure.

Annual reports

PSPs must submit an annual report to the Bank by March 31 of the year following the calendar year being reported on.

The report must include up-to-date information on risk management, incident response, safeguarding practices for end-user funds where applicable, certain financial and activity metrics, and any other information the Bank may require to supervise PSPs.

Submission through PSP Connect

The Bank states that all reports and notifications must be submitted through PSP Connect.

PSPs should ensure their organization’s contact information is up to date and that assigned personnel are familiar with the submission process and relevant timelines.

What this means for PSPs

The reminder does not introduce new requirements, but reinforces that RPAA compliance is an ongoing obligation for registered PSPs.

Firms should ensure they understand when reports are required, who is responsible for submitting them, and what timelines apply. This includes having clear internal processes for identifying reportable incidents, significant changes, registration updates, ownership changes, and annual reporting requirements.

Neopay Global can support PSPs with understanding their RPAA obligations, reviewing compliance frameworks, and strengthening governance, risk management, safeguarding, and regulatory reporting arrangements.